Note to self (and anyone else interested): #Dovecot (which I use for #IMAP) does not seem to automatically notice when certificate PEM files are updated, so will happily just carry on using the ones it loaded at last restart through past their expiry despite those files on disc having been replaced. I don't think any of the other things I have using auto-renewed #LetsEncrypt certs need poking to load new certs... easy to fix, restart Dovecot. I wonder if there's an existing way to automate that with the cert renewal.
Recent searches
Search options
Administered by:
#imap
0 posts0 participants0 posts today
@Ciela @thelusciouslibra I can recommend @monocles tho you should never ever rely on any #eMail hoster, but use #PGP which is easier than ever thanks to @thunderbird on #Desktop and #Android!
Also #monocles does have a cool #eMail client and don't demand extra for #IMAP & #SMTP as well as offering #PayPal, #Stripe, #SEPA #WireTransfer, #CashByMail and #Monero for payment, and they cost as little as €2 p.m.
Over 3 Million Mail Servers without Encryption exposed to Sniffing Attacks.
As scans from the IT-security threat monitoring platform Shadowserver show, 3.3 million hosts are running POP3/IMAP services without TLS encryption enabled and expose usernames & passwords in plain text when transmitted over the Internet.
https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-pop3-report/
![[ImageSource: ShadowServer]
The map shows IMAP and POP3 mail servers without TLS.
Over three million POP3 and IMAP mail servers without TLS encryption are currently exposed on the Internet and vulnerable to network sniffing attacks. Almost 900,000 are based in the U.S., another 560,000 and 380,000 in Germany and Poland, the organization found and adding: “We see around 3.3M such cases with POP3 & a similar amount with IMAP (most overlap). It's time to retire those!” You can check out vulnerability reports for both POP3 email servers and IMAP email hosts on the Shadowserver Foundation site.
IMAP and POP3 are two methods for accessing email on mail servers. IMAP is recommended for checking emails from multiple devices, such as phones and laptops because it keeps your messages on the server and synchronizes them between devices. POP3, on the other hand, downloads emails from the server, making them accessible only from the device where they were downloaded.
The TLS secure communication protocol helps secure users information while exchanging and accessing their emails over the Internet through client/server applications. However, when TLS encryption is not enabled, their messages contents and credentials are sent in clear text, exposing them to eavesdropping network sniffing attacks.
ShadowServer advised all email users to check with their email service provider to be sure that TLS is enabled and the latest version of the protocol is being used.](https://nerdculture.de/system/media_attachments/files/113/798/767/972/144/175/original/202a6becf5e9e0e3.png "[ImageSource: ShadowServer]
The map shows IMAP and POP3 mail servers without TLS.
Over three million POP3 and IMAP mail servers without TLS encryption are currently exposed on the Internet and vulnerable to network sniffing attacks. Almost 900,000 are based in the U.S., another 560,000 and 380,000 in Germany and Poland, the organization found and adding: “We see around 3.3M such cases with POP3 & a similar amount with IMAP (most overlap). It's time to retire those!” You can check out vulnerability reports for both POP3 email servers and IMAP email hosts on the Shadowserver Foundation site.
IMAP and POP3 are two methods for accessing email on mail servers. IMAP is recommended for checking emails from multiple devices, such as phones and laptops because it keeps your messages on the server and synchronizes them between devices. POP3, on the other hand, downloads emails from the server, making them accessible only from the device where they were downloaded.
The TLS secure communication protocol helps secure users information while exchanging and accessing their emails over the Internet through client/server applications. However, when TLS encryption is not enabled, their messages contents and credentials are sent in clear text, exposing them to eavesdropping network sniffing attacks.
ShadowServer advised all email users to check with their email service provider to be sure that TLS is enabled and the latest version of the protocol is being used.")
Replied in thread
THIS is where I disagree...
You may think it's elitist, but if people are too lazy to learn even fundamentals like how to use #Tails then maybe they should just not do #tech at all?
- Like: We expect people to show at the every least theoretical proficiency in terms of #TrafficCode and #VehicleSafety in +every juristiction I'm aware of* and literally mandated #DrivingLicense|s for that reason.
I'll gladly teach #TechIlliterates but I won't waste my time on people that spread disinfo...
It's 2024: @tails_live / @tails has been out for over a decade and there are a shitload of guides ranging from written documentation to Zoomer-friendly TikTok-Style shorts on how to get started.
I don't expect people to do #airgapped pffline-PGP but with @thunderbird including #Enigmail and not requiring any external dependencies like the god-awful #GPG4Win stuff's easier than ever.
Same with #mobile: #Appls like @monocles / #monoclesChat are so easy, I've been able to onboard literal tech-illiterates remotely with few steps and simple instructions.
FOR THE LAST TIME:
*STOP MAKING EXCUSES TO JUSTIFY ESCALATING COMMITMENT TO EVIDENTLY BAD SOLUTIONS!"
- Cuz when push comes to shove @Mer__edith herself would introduce a #Govware #backdoor into @signalapp when faced with indefinite jailtime...
Whereas with #SelfCustody of all the keys as well as #ReproduceableBuilds and real #decentralization, this would be evidently impossible even if all the devs wanted to comply honestly and not just because they could be held at gunpoint.
- #Signal is not your friend. It's merely a tax-exempt "non-profit" corporation, and corporations are explicitly nobodys friend - espechally when they demand #PII like phone numbers for useage.
Compare that to #monocles where you do pay like €2 p.m. but in return get #standard #protocols like #IMAP, #SMTP & #XMPP and can pay anonymously and not have to provide any PII whatsoever!
Make of that what you will, but just like allowing flatearthers to roam freely without caretaker supervision doesn't make the world less round, so won't the facts change about #ITsec, #InfoSec, #OpSec & #ComSec.
- The only reason Signal is still online and not #pwned like #EncroChat is because it's either a Sting op like #ANØM aka. #OperationIronside aka. #OperationTrøjanShield or they have already backdoored their #backend so hard that all their #marketing is just #lies like #Apple...
Because all #centralized, #SingleVendor & #SingleProvider solutions are bad, and if they don't even allow for #SelfCustody then they are just a #grift to #scam tech-illiterates that don't know and/or don't care!
Infosec.SpaceKevin Karhan :verified: (@kkarhan@infosec.space)Attached: 1 image
@Catweazle@vivaldi.net @baeuchle@chaos.social @Linux@kitty.social @torproject@mastodon.social @Vivaldi@vivaldi.net
Claiming that ["[...] Mullvad is as private as Tor [...]"]( https://social.vivaldi.net/@Catweazle/113344664983833218 ) disqualified your for any future discussion.
- If you can't distinguish between a #VPN and #Tor then you are either *criminally incompetent* or *acting as a #UsefulIdiot* by *spreading #FUD and known #disinfo*, which *can get people killed* who believe this bs!
I'll set you some timeout, so you can think about it and apologize in due time!
#thxbye #EOD #next
Replied in thread
@heinelo genau das sehe ich fundamental andersherum, eben weil jene #Monokultur ein Problem ist, sollten Leute umso mehr an offene Standards gewohnt werden.
#MicrosoftOffice kann problemlos #OpenDocument verarbeiten, aber #OOXML ist bewusst so designed dass es faktisch unmöglich ist dies sauber zu implementieren!
- Dasselbe gibt auch bei anderen Standards wie #IMAP vs. #MAPI / #MicrosoftExchange...
Wäre was anderes wenn Mensch zu "Fachsoftware" fenötigt wird wie :würg: SAP oder :kotz: DATEV...
Did you know that Apple iOS doesn't support IMAP IDLE? macOS does, but not iOS. iOS only fetches from your server a few times per hour. I’d periodically open the Mail app to watch it fetch new email. Lame. What if one of those had been important?
Did you also know there’s a plug-in for the Dovecot IMAP server that will send an Apple push notification every time you get a new email, triggering an immediate fetch? Apple uses this to add that Exchange-like magic to iCloud’s IMAP servers, but someone made their own open-source implementation.
I tried setting it all up, but after running into problems with the documentation, I decided it was time to blog about it, so that you can do it, too. https://colincogle.name/push
Colin Cogle · Push Comes to Dove’By adding a few things to your Dovecot IMAP server, you can have instant new mail notifications on your Apple devices.
The approximately four generations deprecated VM that handles my email is finally being killed off by my ISP, and I can't really say that I blame them. I have about a month to find a new email provider for #SMTP and #IMAP. No, I'm not going to host it myself again. Suggestions? So far #Fastmail looks like it's not complete and utter dogshit although obviously it will never be as capable as my tangled mess of custom #exim and #procmail.